New Loop DoS Attack Threatens Hundreds of Thousands of Systems

Researchers at CISPA disclosed “Loop DoS,” a novel application-layer denial-of-service technique that abuses UDP-based protocols (e.g., DNS, NTP, TFTP, Echo, Chargen) by spoofing IP addresses to create self-perpetuating message loops between servers. The issue could affect hundreds of thousands of internet-facing hosts (~300,000), can cause cascading outages, and is mitigable by blocking or restricting UDP-based protocols, moving to authenticated TCP where possible, and limiting host-to-host communication; researchers have not observed widespread exploitation to date.